Barclay Damon LLP, Rochester (Michael P. Scott-Kristansen of counsel), for appellants-respondents. O’Brien Law Office, Clinton (Thomas F. O’Brien of counsel), for respondent- appellant. Cross-appeals from an order of the Supreme Court (Oliver N. Blaise III, J.), entered July 7, 2022 in Chenango County, which (1) denied defendants’ motion for summary judgment dismissing the complaint, and (2) denied plaintiff’s cross-motion to strike defendants’ pleadings. Plaintiff was a patient of defendant Anna Marie Ward, who is a physician employed by defendant UHS Chenango Memorial Hospital at a medical office in the City of Norwich, Chenango County that is affiliated with defendant United Health Services, Inc. (hereinafter UHS). Ward was plaintiff’s primary care physician from 2007 to October 2016 and prescribed plaintiff opioids to help her manage her pain associated with neurofibromatosis. In May 2016, Ward received an anonymous call that plaintiff was selling the opioids that were prescribed to her. After a urine screen that Ward ordered on May 24, 2016 was negative, she decided to wean plaintiff off of the prescription drugs, which she discussed with plaintiff on June 15, 2016. Nicole Knickerbocker was employed as a medical office assistant at a separate UHS outpatient facility in the Town of Vestal, Broome County from March 2016 to late June 2016. Plaintiff “kn[e]w of” Knickerbocker and claimed that another person, unaffiliated with defendant, instructed Knickerbocker to access plaintiff’s medical records out of spite. Plaintiff thereafter filed a complaint with UHS wherein she alleged that a UHS employee — later revealed to be Knickerbocker — had accessed her personal health information without authorization via UHS’ electronic medical records system. The UHS investigation initially revealed that Knickerbocker had accessed plaintiff’s electronic medical records on multiple occasions in May and June 2016 without a reason to do so. Plaintiff commenced this action in 2018 against Ward, UHS and UHS Chenango Memorial Hospital asserting two causes of action. The first asserts that defendants negligently failed to safeguard her medical records by allowing an unauthorized employee to access them, and the second alleges that defendants negligently allowed the unauthorized employee to alter her medical records. After discovery and joinder of issue, defendants moved for summary judgment dismissing the complaint. Plaintiff cross- moved to strike defendants’ pleadings, arguing that defendants negligently or intentionally spoiled key evidence. Supreme Court denied both motions and these cross- appeals ensued. We turn first to plaintiff’s cross-appeal in which she argues that Supreme Court erred in denying her cross-motion to strike defendants’ pleadings due to spoliation. “Sanctions may be imposed where critical items of evidence are negligently disposed of by a litigant before the opposing party has an opportunity to properly review and inspect them” (Miller v. Weyerhaeuser Co., 3 AD3d 627, 628 [3d Dept 2004] [citations omitted], lv dismissed 3 NY3d 701 [2004], appeal dismissed 5 NY3d 822 [2005]; see Jones v. General Motors Corp., 287 AD2d 757, 759 [3d Dept 2001]). “Although reluctant to strike a pleading absent a willful or contumacious failure to facilitate discovery, courts will look to the extent that the spoliation of evidence may prejudice a party and whether a dismissal will be necessary as a matter of elementary fairness” (Puccia v. Farley, 261 AD2d 83, 85 [3d Dept 1999] [internal quotation marks and citations omitted]; see Hartford Fire Ins. Co. v. Regenerative Bldg. Constr., 271 AD2d 862, 863 [3d Dept 2000]). “Absent a clear abuse of discretion, that determination will not be disturbed” (Miller v. Weyerhaeuser Co., 3 AD3d at 628; see Hartford Fire Ins. Co. v. Regenerative Bldg. Constr., 271 AD2d at 863-864). ” ‘[V]ague and speculative allegations regarding prejudice arising from the alleged destruction of documents do not support a claim of spoliation’ ” (Doe v. Heckeroth Plumbing & Heating of Woodstock, Inc., 192 AD3d 1236, 1237-1238 [3d Dept 2021], quoting Clark v. Schuylerville Cent. School Dist., 74 AD3d 1528, 1529 [3d Dept 2010]). In 2019, Supreme Court granted plaintiff’s motion to compel UHS to provide her with metadata related to Knickerbocker’s access of her medical records. According to Deborah Tokos, UHS’ manager of privacy and security, UHS experienced a server failure that limited what their audit reports, which were disclosed to plaintiff, were capable of producing, particularly with regard to what parts of plaintiff’s medical records Knickerbocker had accessed and whether she modified them. Plaintiff does not explain why the unavailability of the metadata is “critical to the core issue” in her action (Randolph v. Warnecke, 1 AD3d 731, 732 [3d Dept 2003]) — that is, whether defendants can be held liable for Knickerbocker’s access of plaintiff’s personal medical information — nor does she demonstrate why its unavailability “is ‘so crucial to [plaintiff's] case that dismissal [of the pleadings] is required as a matter of fundamental fairness’ ” (LaBuda v. LaBuda, 175 AD3d 39, 43 [3d Dept 2019], quoting Jones v. General Motors Corp., 287 AD2d 757, 761 [3d Dept 2001]).[1] Additionally, the metadata plaintiff seeks was lost as a result of a server failure that occurred in September 2016 — almost two years before plaintiff commenced this action and requested the metadata during discovery. Therefore, it cannot be presumed that defendants are responsible for the loss of the metadata or, “more importantly, that it was discarded by [defendants] in an effort to frustrate discovery” (Hartford Fire Ins. Co. v. Regenerative Bldg. Constr., 271 AD2d at 864). Accordingly, Supreme Court did not abuse its discretion when it denied plaintiff’s cross- motion to strike defendants’ pleadings due to spoliation (see LaBuda v. LaBuda, 175 AD3d at 43). We turn now to defendants’ appeal in which they contend that Supreme Court erred in denying their motion for summary judgment because no issue of material fact exists regarding Knickerbocker’s motive for accessing plaintiff’s medical records, which defendants claim was personal, thereby shielding them from vicarious liability. “[T]he doctrine of respondeat superior allows an employer to be held vicariously liable for intentional or negligent acts committed by an employee within the scope of his or her employment, provided that such acts are ‘generally foreseeable and a natural incident of the employment’ ” (Galloway v. State of New York, 212 AD3d 965, 965-966 [3d Dept 2023], quoting Judith M. v. Sisters of Charity Hosp., 93 NY2d 932, 933 [1999]). However, “a medical corporation’s duty of safekeeping a patient’s confidential medical information is limited to those risks that are reasonably foreseeable and to actions within the scope of employment” (Doe v. Guthrie Clinic, Ltd., 22 NY3d 480, 485 [2014]; see Rivera v. State of New York, 34 NY3d 383, 389 [2019]). This Court looks to several factors in order to determine whether an employee was acting within the scope of their employment, including “the connection between the time, place and occasion for the act; the history of the relationship between employer and employee as spelled out in actual practice; whether the act is one commonly done by such an employee; the extent of departure from normal methods of performance; and whether the specific act was one that the employer could reasonably have anticipated (i.e., whether it was foreseeable)” (Galloway v. State of New York, 212 AD3d at 966 [internal quotation marks and citations omitted]). “Whether an employee acted within the scope of employment is a fact-based inquiry. However, the question may be resolved on summary judgment, particularly when the material facts are undisputed” (Rivera v. State of New York, 34 NY3d at 390 [internal citations omitted]). In support of their motion, defendants proffered, among other things, the deposition testimony of plaintiff, an affidavit of Tokos and correspondence from UHS employees regarding their investigation into Knickerbocker’s access to plaintiff’s medical records. This evidence demonstrated that Knickerbocker worked as a receptionist in an entirely different location than the one where plaintiff was treated and was not involved in plaintiff’s care in any fashion. The evidence also demonstrated that Knickerbocker accessed plaintiff’s medical records on at least four occasions in May 2016, and possibly two more occasions in June 2016. In a letter to plaintiff regarding the breach, the vice president and privacy officer of UHS explained that Knickerbocker’s access was “not consistent with [UHS'] privacy practices.” Tokos, in a follow-up letter, described Knickerbocker’s access as “inappropriate[ ].” Tokos, in her affidavit, provided details of Knickerbocker’s access to plaintiff’s records; to wit, on May 2, 2016 she accessed the records for approximately six seconds, on May 4, 2016 for approximately 90 seconds, on May 6, 2016 for approximately 60 seconds and on May 11, 2016 for approximately 90 seconds. Plaintiff, during her deposition, testified that the anonymous phone call during which it was stated that she was dealing drugs came from Ashleigh Rahn, who was plaintiff’s boyfriend’s daughter, and was made out of spite.[2] She testified that she knew the anonymous phone call came from Rahn because Rahn was bragging about it. Plaintiff also testified that Knickerbocker, who was related to Rahn, went into plaintiff’s medical records at the direction of Rahn. Plaintiff’s testimony was unequivocal, expressing no uncertainty during her deposition regarding these events. Defendants also proffered a letter written by plaintiff in June 2016 after Ward informed plaintiff that she would be weaned off the opioids. In the letter, plaintiff explained that her boyfriend’s adult children had “made anonymous phone calls to [Ward's] office stating I am a drug dealer in retaliation of drama going on. I know this as they brag about it.” Continuing to adhere to this narrative, plaintiff requested that her medical records be amended and stated that “[Ward] is very well aware of the girls that are doing this to me.” Given the foregoing, defendants satisfied their prima facie burden establishing that Knickerbocker’s access to plaintiff’s medical records was outside the scope of her employment as she accessed the records out of spite (see generally EPG Assoc., LP v. Cascadilla Sch., 194 AD3d 1158, 1162 [3d Dept 2021], lv dismissed 37 NY3d 1103 [2021]), and we find that Supreme Court erred by finding to the contrary. Given that defendants satisfied their prima facie burden, “the burden shifted to plaintiff[ ] to raise a genuine issue of material fact warranting a trial” (61 Crown St., LLC v. City of Kingston Common Council, 206 AD3d 1316, 1318 [3d Dept 2022], lv denied 39 NY3d 904 [2022]). Plaintiff failed to do so. In opposition to defendants’ motion, relevant to whether Knickerbocker acted outside the scope of her employment, plaintiff submitted her own affidavit dated May 2022. In it, she states that she “do[es] not have any inside knowledge about . . . Knickerbocker. I made a number of assumptions about the motivation for . . . Knickerbocker to access my medical records and the motivation for the person who telephoned . . . Ward’s office claiming I was selling narcotics.” This Court has held that a “[p]laintiff cannot create questions of fact to avoid summary judgment by contradicting [his or] her own deposition testimony through [his or] her self-serving affidavit submitted in opposition to the motion” (Daisernia v. Thomas, 12 AD3d 998, 999 [3d Dept 2004]; see Campagnano v. Highgate Manor of Rensselaer, 299 AD2d 714, 715 [3d Dept 2002]). This is what plaintiff attempts to do here, contradicting statements made in her sworn deposition testimony to raise an issue of fact as to whether Knickerbocker was acting within the scope of her employment. To the extent that plaintiff, in her affidavit, speculates that Knickerbocker’s access to her medical records was a “negligent mistake,” she does not point to any evidence to support this speculation. In fact, the undisputed records which detail Knickerbocker’s unauthorized access demonstrate that Knickerbocker accessed these records at least four times, and that two of these times she accessed plaintiff’s record for 90 seconds, calling into question how she mistakenly accessed the records multiple times and for such lengths of time. Given this undisputed evidence, plaintiff’s speculation that this was a mistake is not sufficient to defeat defendants’ prima facie case (see Stonehill Capital Mgt. LLC v. Bank of the W., 28 NY3d 439, 448 [2016]; Park Place at Malta, LLC v. Berkshire Bank, 148 AD3d 1414, 1417 [3d Dept 2017]). Furthermore, plaintiff’s assertion that her medical record was tampered with by being altered by Knickerbocker, the basis of plaintiff’s second cause of action, is not logically consistent with mistaken access to her medical record. This determination does not foreclose plaintiff’s claims that defendants are directly liable for Knickerbocker’s actions based upon negligent training, hiring, supervision or failure to establish appropriate policies to protect the privacy of plaintiff’s medical record. Indeed, such claims may survive summary judgment where the employee’s actions, while unauthorized, were nevertheless foreseeable (see Eng v. NYU Hosps. Ctr., 172 AD3d 645, 647 [1st Dept 2019]). As to this theory of liability against defendants, we find that they met their prima facie burden demonstrating that Knickerbocker’s acts were not foreseeable. Simply put, there is no evidence to suggest that defendants were aware of Knickerbocker’s relationship to plaintiff and/or that she was improperly accessing plaintiff’s records. In this regard, defendants only learned of same through plaintiff reporting the incident, which occurred after the unauthorized access. Thus, the circumstances presented in this case do not establish that it was foreseeable that Knickerbocker would improperly access plaintiff’s records (compare id.). Moreover, plaintiff failed to rebut this showing by focusing only on general allegations concerning the paucity of defendants’ training and supervision protocols. Although these claims may be accurate, they do not demonstrate that the acts by Knickerbocker were foreseeable or could have been prevented by training and additional supervision.[3] Therefore, Supreme Court erred in declining to grant defendants summary judgment based upon the theory that defendants were directly liable for Knickerbocker’s conduct. Accordingly, as neither theory of liability withstands defendants’ summary judgment motion, plaintiff’s complaint must be dismissed. In light of this determination, we need not reach defendants’ remaining arguments. Lynch, J.P., Aarons, McShan and Mackey, JJ., concur. ORDERED that the order is modified, on the law, without costs, by reversing so much thereof as denied defendants’ motion for summary judgment dismissing the complaint; said motion granted in its entirety and complaint dismissed; and, as so modified, affirmed.
